Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06e84fbd8e5d54001214f5ecb9badc30N.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
General
-
Target
06e84fbd8e5d54001214f5ecb9badc30N.exe
-
Size
6.3MB
-
MD5
06e84fbd8e5d54001214f5ecb9badc30
-
SHA1
2c4cdcba29b651e180b6cbd671b48f7921049682
-
SHA256
8ce6910a38feb7254289c5b3a3b40ca88a0526a2c43e870f765b2afd6fd8cdfa
-
SHA512
e53492167b67c24acd8e84a5520eb5bdb2e67103db9e4be4a4e42d4b91900da9551436afff99d6559ec725d08cb756de0994b26751dc231ce70e97ca7d0db276
-
SSDEEP
98304:tn2UgXq9ouFkULGyqobNq1Mft5rG6uPO276HoVNmnolMsFiHtGh1hN5DTlF01AD4:V2S9+ULdNPtbuPZOOmnqogHh/W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1064 06e84fbd8e5d54001214f5ecb9badc30N.sho -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shohdi.hdi 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 06e84fbd8e5d54001214f5ecb9badc30N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\Uninstall.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\7-Zip\7zG.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.sho 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 06e84fbd8e5d54001214f5ecb9badc30N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4584 1064 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06e84fbd8e5d54001214f5ecb9badc30N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06e84fbd8e5d54001214f5ecb9badc30N.sho -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4996 wrote to memory of 1064 4996 06e84fbd8e5d54001214f5ecb9badc30N.exe 84 PID 4996 wrote to memory of 1064 4996 06e84fbd8e5d54001214f5ecb9badc30N.exe 84 PID 4996 wrote to memory of 1064 4996 06e84fbd8e5d54001214f5ecb9badc30N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\06e84fbd8e5d54001214f5ecb9badc30N.exe"C:\Users\Admin\AppData\Local\Temp\06e84fbd8e5d54001214f5ecb9badc30N.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\06e84fbd8e5d54001214f5ecb9badc30N.shoC:\Users\Admin\AppData\Local\Temp\06e84fbd8e5d54001214f5ecb9badc30N.sho2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 4243⤵
- Program crash
PID:4584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1064 -ip 10641⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD5f1e82d254e13a870fbf61316b1769d71
SHA1f593a3c5c116fffb99e67f32bbf01add71bcb384
SHA25615ac52a5aec8e688aa34ddc707b8bd4d42efea8eaf9fe9c5600b56c70e255f2a
SHA512a5869b53cca1aa85b2cee7b50399b9a0fb065492b891c7df21681d88086fe98500bf324cf7a8a268c3a053c5477936b2f6d752910441d9ae12d08153a785c3d6
-
Filesize
6.3MB
MD506e84fbd8e5d54001214f5ecb9badc30
SHA12c4cdcba29b651e180b6cbd671b48f7921049682
SHA2568ce6910a38feb7254289c5b3a3b40ca88a0526a2c43e870f765b2afd6fd8cdfa
SHA512e53492167b67c24acd8e84a5520eb5bdb2e67103db9e4be4a4e42d4b91900da9551436afff99d6559ec725d08cb756de0994b26751dc231ce70e97ca7d0db276